Cracking Password Hashes: How Dictionary, Brute-Force, and Rainbow Table Attacks Actually Work

Rainbow tables, brute force, and dictionary attacks all target the same thing — a stolen password hash — but they get there in completely different ways, and the defense that stops one does almost nothing against another. Salting defeats rainbow tables outright, yet a salted hash can still be brute forced. Key stretching slows brute force dramatically, yet contributes nothing against an attacker who already has the plaintext from a breached site. This guide walks through how cracking tools actually run each attack against an offline hash, and matches each one to the specific defense that stops it.

Why “Offline” Changes Everything

Once an attacker has copied a password hash out of a breached database, every protection built around login attempts — account lockout, rate limiting, CAPTCHAs — stops mattering. There's no service to lock them out of. The only limit left is pure computation: how many candidate passwords can be hashed and compared per second. That number is what every defense in this guide is ultimately trying to shrink. For the full picture of why offline cracking is so different from online guessing, see our Password Hashing and Offline Cracking guide.

Dictionary and Brute-Force Attacks in a Real Tool

Tools like Hashcat and John the Ripper don't treat "dictionary" and "brute force" as two separate programs — they're different attack modes against the same hash:

• Dictionary (straight) mode feeds in a wordlist of real and previously breached passwords, often combined with rule files that automatically apply the mutations people make — capitalizing the first letter, appending "2026," swapping 3 for e. This is why those substitutions barely help: cracking tools try them by default.
• Brute-force (mask) mode generates every possible combination for a defined pattern — for example, eight characters, mixed case and digits — instead of pulling from a wordlist. It's exhaustive, which is exactly why password length matters so much more than complexity: every additional character multiplies the number of combinations the mask has to grind through.
• Hybrid mode combines the two, appending a mask (like a 2–4 digit suffix) to each dictionary word — covering the common habit of turning "password" into "password2024" without the cost of a pure brute-force run.

Both modes are GPU-accelerated, which is the detail that makes offline cracking dangerous: a single consumer GPU can compute billions of fast hash guesses per second. For the full comparison of brute force, dictionary, spraying, and credential stuffing — including which defense stops each one — see our Password Attacks Explained guide.

Rainbow Tables: Precomputation, Not Guessing

A rainbow table attack skips the guessing entirely. Instead of hashing candidates on the fly, the attacker (or a tool like ophcrack) looks the stolen hash up in a precomputed table that already maps huge numbers of hashes back to their plaintext passwords — built once, reused against any database that used the same unsalted hashing scheme.

This is the one case where the original stub had the right instinct: salting is the complete answer. A salt is a unique, random value added to each password before hashing, so two users with the identical password "Password123" end up with two completely different hashes. A precomputed table built for one hash function with no salt simply cannot be reused once every password is salted — the attacker would need a fresh table per salt, which defeats the entire point of precomputing in the first place. Salts don't need to be secret; they're stored right alongside the hash. Their job is uniqueness, not confidentiality — a separate, secret value called a pepper covers that.

Why Key Stretching Slows the Attacker, Not Just the Password

The original stub's claim is correct but incomplete: key stretching doesn't make any individual password stronger — it makes every single guess more expensive to test, which is a different and arguably more important thing. A password hashing function with a tunable work factor forces thousands (or more) rounds of internal hashing per attempt. A legitimate login pays that cost once; an attacker running a dictionary or brute-force attack pays it on every single candidate, across billions of guesses. Raise the work factor and both sides slow down by the same multiple — but that asymmetry overwhelmingly favors the defender.

The exam lists two specific functions, and they aren't interchangeable in practice:

• PBKDF2 is iteration-based and widely certified (FIPS-approved), but each iteration is computationally cheap, which means GPUs parallelize attacks against it efficiently.
• bcrypt uses a cost parameter and has held up for decades. Along with newer options like scrypt and Argon2, it adds memory hardness — requiring a meaningful amount of memory per guess, not just CPU/GPU cycles — which specifically blunts the massively parallel hardware attackers use for offline cracking.

Our Key Derivation Functions guide covers PBKDF2, bcrypt, scrypt, and Argon2 in full, including why password-based key derivation must be slow while deriving keys from an already-strong secret should not be.

Matching Attack to Defense

• Rainbow table → defeated completely by salting.
• Brute force → slowed by key stretching; defeated in practice by password length.
• Dictionary / hybrid → slowed by key stretching; defeated by avoiding predictable, breached, or pattern-based passwords.

Notice that no single control handles all three — which is exactly why CompTIA tests them as a set rather than one generic "use a strong password" answer. It's also worth remembering that offline cracking isn't the only way an attacker gets access to a password-equivalent secret: techniques like pass-the-hash skip cracking altogether by replaying the hash directly, which is why hashing strength alone is never the whole defense.

Key Takeaways

• Offline attacks ignore lockout and rate limiting entirely — the only limit is raw computational speed.
• Dictionary and brute-force attacks are modes within the same cracking tools (Hashcat, John the Ripper), not separate categories of software.
• Rainbow tables rely on precomputed hash lookups; salting defeats them completely by making every hash unique.
• Key stretching (PBKDF2, bcrypt, and memory-hard functions like scrypt and Argon2) doesn't strengthen a password — it multiplies the cost of testing each guess, which punishes an attacker far more than a legitimate login.
• Different attacks need different defenses: salting stops rainbow tables, length stops brute force, and avoiding predictable or breached passwords stops dictionary attacks.